350-401 Question 575
Select 3An enterprise network administrator wants to secure the IPv6 First-Hop environment against potential threats such as rogue Router Advertisements (RAs), forged DHCPv6 messages, and Neighbor Discovery spoofing. Which combination of IPv6 First Hop Security features should the administrator implement to mitigate these threats effectively?
- A
RA Guard to block unauthorized Router Advertisements
- B
DHCP Guard to filter rogue DHCPv6 server messages
- C
Binding Table to monitor IPv6 traffic and drop untrusted packets
- D
IPv6 ACLs to filter all IPv6 traffic at the edge
- E
ND Inspection/Snooping to validate Neighbor Discovery messages
Show answer and explanation
Correct answers: A, B, E
Explanation
The IPv6 First-Hop Security features are designed to mitigate specific threats in an IPv6 environment. RA Guard blocks rogue Router Advertisements, DHCP Guard protects against unauthorized DHCPv6 servers, and ND Inspection/Snooping ensures the integrity of Neighbor Discovery messages. Together, these features address common IPv6-specific threats effectively.
- A. Correct.
RA Guard is designed to block unauthorized or rogue Router Advertisements, making it effective against RA-based attacks.
- B. Correct.
DHCP Guard ensures only authorized DHCPv6 servers can provide configuration to clients, mitigating rogue DHCP server threats.
- C. Incorrect.
Binding Table by itself does not filter or block traffic; it is used as part of mechanisms like ND Inspection to validate IPv6 traffic.
- D. Incorrect.
IPv6 ACLs can filter traffic but are not specifically designed to address IPv6 First-Hop Security threats like rogue RAs or DHCPv6 messages.
- E. Correct.
ND Inspection/Snooping validates the integrity of Neighbor Discovery messages to protect against spoofing and man-in-the-middle attacks.